Proxima, a Solana token-launch and trading platform, says private keys for some user wallets sat in its own debug logs for a week, and that an attacker pulled them out through an outdated monitoring server to drain 5,324.2 SOL on Saturday. The figure in the company’s post-mortem is worth roughly $400,000 at Solana’s price during the attack, well above the $200,000 to $250,000 it first estimated. Proxima says it has refunded all 181 affected users from its own treasury.
What the post-mortem says
The report, published by co-founder Theo late on Nov. 14, says the attacker drained 870 Solana wallets between 03:22 and 05:42 UTC. Proxima put that at about 0.1% of the wallets on its platform. Only SOL balances were taken; the company said no token holdings or EVM funds were stolen.
The chain of failures started inside Proxima. Between Nov. 3 and Nov. 10, the team lowered its production logging level from info to debug to monitor performance. A debug statement that had been added around wallet operations for a private-beta feature was caught up in that change, and it wrote private key material into the logs whenever a wallet was created, imported, updated or otherwise needed its key. “This log was never meant to be emitted in production,” the report says.
Proxima switched that logging off on Nov. 10 but did not know keys had been recorded. Its logs were kept for 15 days, so the data was still sitting in its SigNoz instance, an open-source observability tool, when the attacker arrived. “We process hundreds of thousands of log lines per day, which makes manual review impossible, and we had no automated process in place to detect this kind of leak,” the company wrote.
An old server with its firewall rule gone
Two more problems turned a logging mistake into a theft. The SigNoz instance had been set up months earlier by an outside consultant and left on an older version, with the upgrade “repeatedly postponed,” according to the report. That version had a publicly disclosed flaw that allowed unauthenticated access to stored data.
The server was also supposed to be hidden from the internet behind a Cloudflare firewall rule. That rule had been “inadvertently removed,” Proxima said. The attacker extracted logs from 02:16 to 05:30 UTC and began draining wallets while the extraction was still running.
Proxima did not say which SigNoz vulnerability was used. SigNoz’s own GitHub page lists several advisories since mid-September, including CVE-2026-97055, published Sept. 23, in which an empty default signing secret let anyone who knew a user’s ID and organization ID forge a valid session token for that user, including an admin. It was fixed in version 0.143.0. Whether that is the bug in this case is not confirmed.
The timeline also shows how long the drain ran before anyone reacted. The first theft was at 03:22 UTC, first alerts arrived around 04:45, and Proxima started moving funds out of exposed wallets at 05:23, while the attack was still going on. The last drain came at 05:42.
Why the first estimate was low
Theo’s first public statement, at 06:48 UTC on Saturday, said “approximately $200-250k in affected funds (less than 5% of total funds).” Coinbase’s SOL price ranged between $74.74 and $76.27 in the hours the attack ran, which values 5,324.2 SOL at between about $398,000 and $406,000. At Sunday’s price near $70, it would be about $374,000. Proxima has not given its own dollar figure for the final loss.
Theo also said in a midday update that “other protocols have also been impacted to varying degrees.” He did not name them, and AltcoinReporter could not confirm other victims.
Refunds and what users have to do
Each affected account was given a new refund wallet credited with the exact SOL taken, the report says. Exposed wallets were replaced with newly generated ones, and remaining balances were moved across; the report says no assets were sold in standard migrations. A small number of very large token positions linked to active launches were left in their original wallets “to avoid disrupting their markets” and will be handled with their owners individually.
Pashov Audit Group said it had checked the payouts: “Pashov Audit Group verified all refunds have been properly executed on-chain. Users are 100% covered.”
Users still have work to do. Old wallets are labeled “Compromised” or “Possibly exposed” in the app and should not receive any more funds. Anyone who used one of those keys outside Proxima should treat it as compromised everywhere. Automated autosell, autobuy, market-making and volume sessions were paused and must be restarted with the new wallets. Proxima says private key exports now require two-factor authentication, and that it has patched the monitoring tool, cut off public access and rotated credentials.
“We recognize that sensitive private key material should never have been present in diagnostic logs,” the company wrote. It is not the only case this week in which keys held by a service, rather than a smart-contract bug, were the weak point. Indian exchange Unocoin has said it suspects wallet backup keys were used to move funds out of its BitGo wallets.
FAQ
How much was stolen from Proxima?
Proxima says 5,324.2 SOL was drained from 870 wallets belonging to 181 users on Nov. 14. At Coinbase prices during the attack, that was worth about $400,000.
How did the attacker get the private keys?
According to the post-mortem, debug logs stored keys between Nov. 3 and Nov. 10, and the attacker read them from Proxima’s SigNoz monitoring server, which ran an outdated version and had lost its firewall rule.
Have Proxima users been repaid?
Proxima says all 181 affected users were refunded in full from its treasury, and Pashov Audit Group said it verified the refunds on-chain.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
